SB2026041094 - Multiple vulnerabilities in Lodash

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2026-4800)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.

Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().

2) Prototype pollution (CVE-ID: CVE-2026-2950)

The vulnerability allows a remote attacker to modify object prototype attributes.

The vulnerability exists due to improper control of object prototype modification in _.unset and _.omit when processing array-wrapped path segments. A remote attacker can pass crafted path segments to modify object prototype attributes.

The bypass affects checks that only guard against string key members. The issue permits deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype, but does not allow overwriting their original behavior.

Remediation

Install update from vendor's website.

References

• https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
• https://github.com/advisories/GHSA-r5fr-rjxr-66jc
• https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
• https://github.com/advisories/GHSA-f23m-r3pf-42rh